+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [C] Basic C Language Question for malloc() - Buffer Overflow (/showthread.php?tid=5171300)
Basic C Language Question for malloc() - Buffer Overflow - DarkETHOS - Feb 15, 2016
So with the following codes below for testing out buffer-overflow, why does the output of the variable name and command always come out different, is it due to the usage of memory not being 'static' - always flactuating? Variable name and command as in the address of 'Name' and 'Command'.
Tutorial is gotten from some guy on youtube, am still learning..
Quote:#include <stdio.h>
void main()
{
char *name;
char *command;
name=(char *)malloc(10);
command=(char *)malloc(128);
printf("address of Name is : %d\n", name);
printf("address of Command is : %d\n", command);
printf("Difference between address is : %d\n", command - name);
printf("Hey enter your name: ");
gets(name);
printf("Hello %s\n", name);
system(command);
}
* - Annabelle Lee - Feb 15, 2016
(Feb 15, 2016 07:56 AM)DarkETHOS Wrote: So with the following codes below for testing out buffer-overflow, why does the output of the variable name and command always come out different, is it due to the usage of memory not being 'static' - always flactuating? Variable name and command as in the address of 'Name' and 'Command'.
and what does the asterisk in name and *command meant, I read that is deference from a pointer, can someone confirm?
Tutorial is gotten from some guy on youtube, am still learning..
Those are different because every-time the program executes, they are given a different place in memory that they are put in. It doesn't have to do with just malloc, even a normal variable will have a different place in memory each time it's run.
And for the and &. Look here: http://stackoverflow.com/questions/57483/what-are-the-differences-between-a-pointer-variable-and-a-reference-variable-in/57492#57492
* - DarkETHOS - Feb 15, 2016
(Feb 15, 2016 08:30 AM)AnnabelleLee Wrote: Those are different because every-time the program executes, they are given a different place in memory that they are put in. It doesn't have to do with just malloc, even a normal variable will have a different place in memory each time it's run.
And for the * and &. Look here: http://stackoverflow.com/questions/57483/what-are-the-differences-between-a-pointer-variable-and-a-reference-variable-in/57492#57492
Thanks a lot!! Omg, all this pointer and acronym EAX EBX is killing me.. need to practice this for a coming buffer overflow test.
* - p007 - Feb 16, 2016
malloc allocates the specified number of bytes in the heap, the function is implemented by the operation system, the OS "gives" to the process a allocated location with the specified number of bytes, so each time the location is different.
* - Goodies - Feb 16, 2016
The locations of any variables on the stack or within other segments of the binary will be randomized if ASLR is enabled (OS may vary on implementation) but essentially this means that the base address of the program's allocated virtual memory will be randomized. This way, you cannot refer to the same spot in memory and know that it always uses holds the same data.
However, malloc() is not completely like this. It will grab from an available place in heap memory that is not determined, even if ASLR is completely off. On unix, it uses the sbrk system call which dynamically raises the size of the data segment, but as this is dynamic throughout the program, there is no guarantee from where the memory will be allocated. In windows, I believe it uses HeapAlloc, but there are other functions that you would use like VirtualAlloc or new[] (in C++). The principle, I believe, is the same.
ALSO FREE YOUR MEMORY
Any time I see malloc() or calloc(), there had better be a corresponding free() call.
PHP Code
<?php
name=(char *)malloc(10);
command=(char *)malloc(128);
// ... some code here ...
free(name);
free(command);
Also, @p007 that is right, but keep in mind that it gives you at least N number of bytes in malloc(N). Alignment needs and whatnot may give you more, but if the command succeeds, you are guaranteed to have at least N number of usable bytes.